@stamhoofd/backend 2.120.6 → 2.122.0

package/src/services/PaymentService.ts

@@ -1,30 +1,61 @@
-import { createMollieClient, PaymentMethod as molliePaymentMethod, PaymentStatus as MolliePaymentStatus } from '@mollie/api-client';
-import { SimpleError } from '@simonbackx/simple-errors';
-import type { BalanceItem, Member, User } from '@stamhoofd/models';
-import { BalanceItemPayment, Group, MolliePayment, MollieToken, Organization, PayconiqPayment, Payment, sendEmailTemplate } from '@stamhoofd/models';
+import { isSimpleError, isSimpleErrors, SimpleError } from '@simonbackx/simple-errors';
+import type { Member, User } from '@stamhoofd/models';
+import { BalanceItem, BalanceItemPayment, Group, Organization, PayconiqPayment, Payment, Platform, sendEmailTemplate, UsedRegisterCode } from '@stamhoofd/models';
 import { QueueHandler } from '@stamhoofd/queues';
-import type { Checkoutable, PaymentConfiguration } from '@stamhoofd/structures';
-import { AuditLogSource, BalanceItemType, EmailTemplateType, PaymentCustomer, PaymentMethod, PaymentMethodHelper, PaymentProvider, PaymentStatus, PaymentType, Recipient, VATExcemptReason, Version } from '@stamhoofd/structures';
+import type { Checkoutable, PaymentConfiguration, PrivatePaymentConfiguration } from '@stamhoofd/structures';
+import { AuditLogSource, BalanceItemPaymentDetailed, BalanceItemType, EmailTemplateType, Invoice, PaymentCustomer, PaymentGeneral, PaymentMethod, PaymentMethodHelper, PaymentProvider, PaymentStatus, PaymentType, Recipient, Replacement, VATExcemptReason, Version } from '@stamhoofd/structures';
+import type { CreateMandateSettings } from '@stamhoofd/structures/checkout/CreateMandateSettings.js';
+import type { PaymentMandate } from '@stamhoofd/structures/PaymentMandate.js';
+import { PaymentMandateStatus, PaymentMandateType } from '@stamhoofd/structures/PaymentMandate.js';
 import { Formatter } from '@stamhoofd/utility';
 import { buildReplacementOptions, getEmailReplacementsForPayment } from '../email-replacements/getEmailReplacementsForPayment.js';
 import { BuckarooHelper } from '../helpers/BuckarooHelper.js';
 import { Context } from '../helpers/Context.js';
 import { ServiceFeeHelper } from '../helpers/ServiceFeeHelper.js';
 import { StripeHelper } from '../helpers/StripeHelper.js';
+import { ViesHelper } from '../helpers/ViesHelper.js';
 import { AuditLogService } from './AuditLogService.js';
 import { BalanceItemPaymentService } from './BalanceItemPaymentService.js';
 import { BalanceItemService } from './BalanceItemService.js';
+import { MollieService } from './MollieService.js';
+import { PaymentMandateService } from './PaymentMandateService.js';
+import { ReferralService } from './ReferralService.js';
+import { VATService } from './VATService.js';
+import { STPackageService } from './STPackageService.js';
 
 export class PaymentService {
-    static async handlePaymentStatusUpdate(payment: Payment, organization: Organization, status: PaymentStatus) {
+    static async updateReversedPaymentsFor(payment: Payment) {
+        if (payment.reversingPaymentId) {
+            // Update refund amount of that payment
+            const reversingPayment = await Payment.getByID(payment.reversingPaymentId);
+            if (reversingPayment) {
+                await reversingPayment.updateRefundedAmount();
+            }
+        }
+    }
+
+    static async handlePaymentStatusUpdate(payment: Payment, organization: Organization, status: PaymentStatus, paidAt?: Date) {
         if (payment.status === status) {
             return;
         }
 
+        if (status === PaymentStatus.Failed && payment.invoiceId) {
+            throw new SimpleError({
+                code: 'cannot_fail',
+                message: 'A payment that has been invoiced cannot be marked as failed. Instead create a separate chargeback payment with a negative amount.',
+                human: $t('%1RI'),
+            });
+        }
+
+        if (organization.id !== payment.organizationId) {
+            throw new Error('Unexpected organization, expected ' + payment.organizationId + ', received ' + organization.id);
+        }
+
         await AuditLogService.setContext({ fallbackUserId: payment.payingUserId, source: AuditLogSource.Payment, fallbackOrganizationId: payment.organizationId }, async () => {
             if (status === PaymentStatus.Succeeded) {
+                console.log('Marking as succeeded', payment.id);
                 payment.status = PaymentStatus.Succeeded;
-                payment.paidAt = new Date();
+                payment.paidAt = paidAt ?? new Date();
                 await payment.save();
 
                 // Prevent concurrency issues
@@ -42,7 +73,31 @@ export class PaymentService {
 
                     // Flush caches so data is up to date in response
                     await BalanceItemService.flushCaches(organization.id);
+
+                    await this.updateReversedPaymentsFor(payment);
                 });
+
+                if (payment.price >= 100_00 && payment.organizationId && payment.payingOrganizationId && payment.organizationId === ((await Platform.getShared()).membershipOrganizationId)) {
+                    // We spend some money
+                    const code = await UsedRegisterCode.getFor(payment.payingOrganizationId);
+                    if (code && !code.balanceItemId) {
+                        console.log('Rewarding code ' + code.id + ' for payment');
+
+                        // Deze code werd nog niet beloond
+                        await ReferralService.reward(code);
+                    }
+                }
+
+                // It is possible the mandate succeeds immediately, in which case we might
+                // need to save it as the default payment method
+                await this.saveMandateIfNeeded({
+                    payment,
+                    sellingOrganizationId: organization.id,
+                });
+
+                if (payment.type === PaymentType.Chargeback) {
+                    await this.handleChargebackCreated(payment, organization);
+                }
                 return;
             }
 
@@ -69,11 +124,14 @@ export class PaymentService {
 
                     // Flush caches so data is up to date in response
                     await BalanceItemService.flushCaches(organization.id);
+
+                    await this.updateReversedPaymentsFor(payment);
                 });
             }
 
             // Moved to failed
             if (status === PaymentStatus.Failed) {
+                console.log('Marking as failed', payment.id);
                 await QueueHandler.schedule('balance-item-update/' + organization.id, async () => {
                     const balanceItemPayments = await BalanceItemPayment.balanceItem.load(
                         (await BalanceItemPayment.where({ paymentId: payment.id })).map(r => r.setRelation(BalanceItemPayment.payment, payment)),
@@ -88,6 +146,10 @@ export class PaymentService {
                     // Flush caches so data is up to date in response
                     await BalanceItemService.flushCaches(organization.id);
                 });
+
+                if (payment.type === PaymentType.Payment) {
+                    await this.handlePaymentFailed(payment, organization);
+                }
             }
 
             // If OLD status was FAILED, we need to revert the actions
@@ -110,6 +172,102 @@ export class PaymentService {
         });
     }
 
+    private static async handleChargebackCreated(payment: Payment, organization: Organization) {
+        if (!payment.payingOrganizationId) {
+            // For now only for B2B
+            return;
+        }
+
+        const payingOrganization = await Organization.getByID(payment.payingOrganizationId, true);
+
+        await sendEmailTemplate(organization, {
+            recipients: await payingOrganization.getFinanceAdminRecipients(),
+            defaultReplacements: [
+                Replacement.create({
+                    token: 'payingOrganizationName',
+                    value: payingOrganization.name,
+                }),
+                Replacement.create({
+                    token: 'paymentUrl',
+                    value: 'https://' + payingOrganization.getDashboardHost() + '/boekhouding/openstaand/' + organization.uri,
+                }),
+            ],
+            template: {
+                type: EmailTemplateType.ChargebackPayingOrganization,
+            },
+            type: 'transactional',
+        });
+
+        await this.deactivatePackagesIfNeeded(payment, organization);
+    }
+
+    private static async handlePaymentFailed(payment: Payment, organization: Organization) {
+        if (!payment.payingOrganizationId) {
+            // For now only for B2B
+            return;
+        }
+
+        if (!payment.mandateId) {
+            return;
+        }
+
+        if (!payment.adminUserId && payment.method !== PaymentMethod.DirectDebit) {
+            return;
+        }
+
+        const payingOrganization = await Organization.getByID(payment.payingOrganizationId, true);
+
+        await sendEmailTemplate(organization, {
+            recipients: await payingOrganization.getFinanceAdminRecipients(),
+            defaultReplacements: [
+                Replacement.create({
+                    token: 'payingOrganizationName',
+                    value: payingOrganization.name,
+                }),
+                Replacement.create({
+                    token: 'paymentUrl',
+                    value: 'https://' + payingOrganization.getDashboardHost() + '/boekhouding/openstaand/' + organization.uri,
+                }),
+            ],
+            template: {
+                type: EmailTemplateType.AutomaticChargeFailedPayingOrganization,
+            },
+            type: 'transactional',
+        });
+
+        await this.deactivatePackagesIfNeeded(payment, organization);
+    }
+
+    private static async deactivatePackagesIfNeeded(payment: Payment, organization: Organization) {
+        // If admin initiated mandate, then mark packages as failed only
+        if ((payment.adminUserId || payment.type === PaymentType.Chargeback) && payment.mandateId && STAMHOOFD.userMode === 'organization') {
+            const platform = await Platform.getShared();
+            const payingOrganizationId = payment.payingOrganizationId;
+            if (payingOrganizationId && organization.id === platform.membershipOrganizationId) {
+                await STPackageService.markFailedPayment(payingOrganizationId);
+            }
+        }
+    }
+
+    static async saveMandateIfNeeded({ payment, sellingOrganizationId }: { payment: Payment; sellingOrganizationId: string }) {
+        // Save as default
+        if (payment.createMandate && payment.createMandate.saveAsDefault) {
+            if (payment.mandateId && payment.status === PaymentStatus.Succeeded) {
+                try {
+                    await PaymentMandateService.setDefaultMandate({
+                        mandateId: payment.mandateId,
+                        payingOrganizationId: payment.payingOrganizationId,
+                        sellingOrganizationId,
+                        payingUserId: payment.payingUserId,
+                    });
+                } catch (e) {
+                    // Ignore as setting the payment status is more important
+                    console.error(e);
+                }
+            }
+        }
+    }
+
     /**
      * ID of payment is needed because of race conditions (need to fetch payment in a race condition save queue)
      */
@@ -122,6 +280,11 @@ export class PaymentService {
                 return;
             }
 
+            if (org && payment.organizationId !== org.id && org.id !== payment.payingOrganizationId) {
+                console.error('Non-matching organization found for payment', payment.id, 'org', org.id);
+                return;
+            }
+
             // Explicitly set userId to null, because all actions caused by a poll are not caused by the currently signed in user, but the paying user id
             return await AuditLogService.setContext({ userId: payment.payingUserId ?? null, source: AuditLogSource.Payment }, async () => {
                 if (!payment.organizationId) {
@@ -129,11 +292,15 @@ export class PaymentService {
                     return;
                 }
 
-                const organization = org ?? await Organization.getByID(payment.organizationId);
+                const organization = org && org.id === payment.organizationId ? org : await Organization.getByID(payment.organizationId);
                 if (!organization) {
                     console.error('Organization not found for payment', payment.id);
                     return;
                 }
+                if (org && org.id !== payment.organizationId && org.id !== payment.payingOrganizationId) {
+                    console.error('Non-matching organization found for payment', payment.id, 'org', org.id);
+                    return;
+                }
 
                 const testMode = organization.privateMeta.useTestPayments ?? STAMHOOFD.environment !== 'production';
 
@@ -147,101 +314,46 @@ export class PaymentService {
                                 status = PaymentStatus.Failed;
                             }
 
+                            console.log('Stripe setting status to', status);
                             await this.handlePaymentStatusUpdate(payment, organization, status);
-                        }
-                        catch (e) {
+                        } catch (e) {
                             console.error('Payment check failed Stripe', payment.id, e);
                             if (this.isManualExpired(payment.status, payment)) {
                                 console.error('Manually marking Stripe payment as expired', payment.id);
                                 await this.handlePaymentStatusUpdate(payment, organization, PaymentStatus.Failed);
                             }
                         }
-                    }
-                    else if (payment.provider === PaymentProvider.Mollie) {
-                        // check status via mollie
-                        const molliePayments = await MolliePayment.where({ paymentId: payment.id }, { limit: 1 });
-                        if (molliePayments.length === 1) {
-                            const molliePayment = molliePayments[0];
-                            // check status
-                            const token = await MollieToken.getTokenFor(organization.id);
-
-                            if (token) {
-                                try {
-                                    const mollieClient = createMollieClient({ accessToken: await token.getAccessToken() });
-                                    let mollieData = await mollieClient.payments.get(molliePayment.mollieId, {
-                                        testmode: organization.privateMeta.useTestPayments ?? STAMHOOFD.environment !== 'production',
-                                    });
-
-                                    console.log(mollieData); // log to log files to check issues
-
-                                    const details = mollieData.details as any;
-                                    if (details?.consumerName) {
-                                        payment.ibanName = details.consumerName;
-                                    }
-                                    if (details?.consumerAccount) {
-                                        payment.iban = details.consumerAccount;
-                                    }
-                                    if (details?.cardHolder) {
-                                        payment.ibanName = details.cardHolder;
-                                    }
-                                    if (details?.cardNumber) {
-                                        payment.iban = 'xxxx xxxx xxxx ' + details.cardNumber;
-                                    }
-
-                                    if (mollieData.status === MolliePaymentStatus.paid) {
-                                        await this.handlePaymentStatusUpdate(payment, organization, PaymentStatus.Succeeded);
-                                    }
-                                    else if (mollieData.status === MolliePaymentStatus.failed || mollieData.status === MolliePaymentStatus.expired || mollieData.status === MolliePaymentStatus.canceled) {
-                                        await this.handlePaymentStatusUpdate(payment, organization, PaymentStatus.Failed);
-                                    }
-                                    else if ((cancel || this.shouldTryToCancel(payment.status, payment)) && mollieData.isCancelable) {
-                                        console.log('Cancelling Mollie payment on request', payment.id);
-                                        mollieData = await mollieClient.payments.cancel(molliePayment.mollieId);
-
-                                        if (mollieData.status === MolliePaymentStatus.paid) {
-                                            await this.handlePaymentStatusUpdate(payment, organization, PaymentStatus.Succeeded);
-                                        }
-                                        else if (mollieData.status === MolliePaymentStatus.failed || mollieData.status === MolliePaymentStatus.expired || mollieData.status === MolliePaymentStatus.canceled) {
-                                            await this.handlePaymentStatusUpdate(payment, organization, PaymentStatus.Failed);
-                                        }
-                                        else if (this.isManualExpired(payment.status, payment)) {
-                                            // Mollie still returning pending after 1 day: mark as failed
-                                            console.error('Manually marking Mollie payment as expired', payment.id);
-                                            await this.handlePaymentStatusUpdate(payment, organization, PaymentStatus.Failed);
-                                        }
-                                    }
-                                    else if (this.isManualExpired(payment.status, payment)) {
-                                        // Mollie still returning pending after 1 day: mark as failed
-                                        console.error('Manually marking Mollie payment as expired', payment.id);
-                                        await this.handlePaymentStatusUpdate(payment, organization, PaymentStatus.Failed);
-                                    }
-                                }
-                                catch (e) {
-                                    console.error('Payment check failed Mollie', payment.id, e);
-                                    if (this.isManualExpired(payment.status, payment)) {
-                                        console.error('Manually marking Mollie payment as expired', payment.id);
-                                        await this.handlePaymentStatusUpdate(payment, organization, PaymentStatus.Failed);
-                                    }
+                    } else if (payment.provider === PaymentProvider.Mollie) {
+                        try {
+                            const mollieClient = await MollieService.create({
+                                sellingOrganization: organization,
+                            });
+                            if (mollieClient) {
+                                let { status } = await mollieClient.getStatus(payment, cancel || this.shouldTryToCancel(payment.status, payment));
+
+                                if (this.isManualExpired(status, payment)) {
+                                    console.error('Manually marking Mollie payment as expired', payment.id);
+                                    status = PaymentStatus.Failed;
                                 }
-                            }
-                            else {
-                                console.warn('Mollie payment is missing for organization ' + organization.id + ' while checking payment status...');
 
+                                console.log('Mollie setting status to', status);
+                                await this.handlePaymentStatusUpdate(payment, organization, status);
+                            } else {
+                                console.error('Missing Mollie Credentials for payment', payment.id);
                                 if (this.isManualExpired(payment.status, payment)) {
-                                    console.error('Manually marking payment without mollie token as expired', payment.id);
+                                    console.error('Manually marking Mollie payment as expired', payment.id);
                                     await this.handlePaymentStatusUpdate(payment, organization, PaymentStatus.Failed);
                                 }
                             }
-                        }
-                        else {
+                        } catch (e) {
+                            console.error('Payment check failed Mollie', payment.id, e);
                             if (this.isManualExpired(payment.status, payment)) {
-                                console.error('Manually marking payment without mollie payments as expired', payment.id);
+                                console.error('Manually marking Mollie payment as expired', payment.id);
                                 await this.handlePaymentStatusUpdate(payment, organization, PaymentStatus.Failed);
                             }
                         }
-                    }
-                    else if (payment.provider == PaymentProvider.Buckaroo) {
-                        const helper = new BuckarooHelper(organization.privateMeta.buckarooSettings?.key ?? '', organization.privateMeta.buckarooSettings?.secret ?? '', organization.privateMeta.useTestPayments ?? STAMHOOFD.environment !== 'production');
+                    } else if (payment.provider === PaymentProvider.Buckaroo) {
+                        const helper = new BuckarooHelper(organization.privateMeta.buckarooSettings?.key ?? '', organization.privateMeta.buckarooSettings?.secret ?? '', testMode);
                         try {
                             let status = await helper.getStatus(payment);
 
@@ -250,17 +362,16 @@ export class PaymentService {
                                 status = PaymentStatus.Failed;
                             }
 
+                            console.log('Buckaroo setting status to', status);
                             await this.handlePaymentStatusUpdate(payment, organization, status);
-                        }
-                        catch (e) {
+                        } catch (e) {
                             console.error('Payment check failed Buckaroo', payment.id, e);
                             if (this.isManualExpired(payment.status, payment)) {
                                 console.error('Manually marking Buckaroo payment as expired', payment.id);
                                 await this.handlePaymentStatusUpdate(payment, organization, PaymentStatus.Failed);
                             }
                         }
-                    }
-                    else if (payment.provider == PaymentProvider.Payconiq) {
+                    } else if (payment.provider == PaymentProvider.Payconiq) {
                         // Check status
 
                         const payconiqPayments = await PayconiqPayment.where({ paymentId: payment.id }, { limit: 1 });
@@ -278,8 +389,7 @@ export class PaymentService {
                                 console.error('Manually cancelling Payconiq payment', payment.id);
                                 if (await payconiqPayment.cancel(organization)) {
                                     status = PaymentStatus.Failed;
-                                }
-                                else {
+                                } else {
                                     console.error('Failed to manually cancel payment');
                                 }
                             }
@@ -290,8 +400,7 @@ export class PaymentService {
                             }
 
                             await this.handlePaymentStatusUpdate(payment, organization, status);
-                        }
-                        else {
+                        } else {
                             console.warn('Payconiq payment is missing for organization ' + organization.id + ' while checking payment status...');
 
                             if (this.isManualExpired(payment.status, payment)) {
@@ -299,19 +408,17 @@ export class PaymentService {
                                 await this.handlePaymentStatusUpdate(payment, organization, PaymentStatus.Failed);
                             }
                         }
-                    }
-                    else {
+                    } else {
                         console.error('Invalid payment provider', payment.provider, 'for payment', payment.id);
                         if (this.isManualExpired(payment.status, payment)) {
                             console.error('Manually marking unknown payment as expired', payment.id);
                             await this.handlePaymentStatusUpdate(payment, organization, PaymentStatus.Failed);
                         }
                     }
-                }
-                else {
+                } else {
                     // Do a manual update if needed
                     if (payment.status === PaymentStatus.Succeeded) {
-                        if (payment.provider === PaymentProvider.Stripe) {
+                        if ((payment.provider === PaymentProvider.Mollie && STAMHOOFD.environment === 'development')) {
                             // Update the status
                             await StripeHelper.getStatus(payment, false, testMode);
                         }
@@ -329,6 +436,18 @@ export class PaymentService {
                 return true;
             }
         }
+
+        if (STAMHOOFD.environment === 'development') {
+            // In development, we expire all direct debits and other paymetns after 1 hour, because they need manual changes
+            // otherwise they will remain stuck in the dev environment, poluting the UI
+            if ((status === PaymentStatus.Pending || status === PaymentStatus.Created)) {
+                // If payment is not succeeded after one day, mark as failed
+                if (payment.createdAt < new Date(new Date().getTime() - 60 * 1000 * 60)) {
+                    return true;
+                }
+            }
+        }
+
         return false;
     }
 
@@ -336,7 +455,7 @@ export class PaymentService {
      * Try to cancel a payment that is still pending
      */
     static shouldTryToCancel(status: PaymentStatus, payment: Payment): boolean {
-        if ((status === PaymentStatus.Pending || status === PaymentStatus.Created) && payment.method !== PaymentMethod.DirectDebit) {
+        if ((status === PaymentStatus.Pending || status === PaymentStatus.Created) && (payment.method !== PaymentMethod.DirectDebit || STAMHOOFD.environment === 'development')) {
             let timeout = STAMHOOFD.environment === 'development' ? 60 * 1000 * 2 : 60 * 1000 * 30;
 
             // If payconiq and not yet 'identified' (scanned), cancel after 5 minutes
@@ -356,39 +475,45 @@ export class PaymentService {
      * we'll need to round the payment to 1 cent. That can cause issues in the financial statements because
      * the total amount of balances does not match the total amount received/paid.
      *
-     * To fix that, we create an extra balance item with the difference. So the rounding always matches.
-     *
-     * TODO: update this method to generate a virtual invoice and use the price of the invoice instead of the rounded payment price, so we don't get differences in calculation
+     * To fix that, we create an extra roundingAmount with the difference. So the rounding always matches.
      */
-    static round(payment: Payment) {
-        const amount = payment.price;
-        const rounded = Payment.roundPrice(payment.price);
+    static roundPayment(payment: Payment) {
+        // Calculate total price of the balance items
+        // this fixes issus when the method is called multiple times
+        // should be subtracted, not added
+        const balanceItemsTotalPrice = payment.price - payment.roundingAmount;
+
+        const { roundingAmount, price } = this.round(balanceItemsTotalPrice);
+        payment.roundingAmount = roundingAmount;
+        payment.price = price;
+    }
+
+    static round(amount: number) {
+        const rounded = Payment.roundPrice(amount);
         const difference = rounded - amount;
 
         if (difference === 0) {
-            return;
+            return {
+                price: amount,
+                roundingAmount: 0,
+            };
         }
 
         if (difference > 100 || difference < -100) {
-            throw new Error('Unexpected rounding difference of ' + difference + ' for payment ' + payment.id);
+            throw new Error('Unexpected rounding difference of ' + difference + ' for price ' + amount.toString());
         }
 
-        payment.roundingAmount = difference;
-
-        // Change payment total price
-        payment.price += difference;
+        return {
+            price: amount + difference,
+            roundingAmount: difference,
+        };
     }
 
-    static async createPayment({ balanceItems, organization, user, members, checkout, payingOrganization, serviceFeeType }: {
+    static calculateTotalPrice({ balanceItems, organization, members }: {
         balanceItems: Map<BalanceItem, number>;
         organization: Organization;
-        user: User;
         members?: Member[];
-        checkout: Pick<Checkoutable<never>, 'paymentMethod' | 'totalPrice' | 'customer' | 'cancelUrl' | 'redirectUrl'>;
-        payingOrganization?: Organization | null;
-        serviceFeeType: 'webshop' | 'members' | 'tickets' | 'system';
     }) {
-        // Calculate total price to pay
         let totalPrice = 0;
         const names: {
             firstName: string;
@@ -437,113 +562,272 @@ export class PaymentService {
                 });
             }
         }
+        const { price, roundingAmount } = this.round(totalPrice);
 
-        if (totalPrice < 0) {
-            // todo: try to make it non-negative by reducing some balance items
+        if (price < 0) {
             throw new SimpleError({
                 code: 'negative_price',
                 message: $t(`%vl`),
             });
         }
 
-        if (checkout.totalPrice !== null && totalPrice !== checkout.totalPrice) {
-            // Changed!
+        return { hasNegative, price, roundingAmount, names };
+    }
+
+    static validateTotalPrice({ price, roundingAmount, checkout }: {
+        price: number; // already rounded
+        roundingAmount: number;
+        checkout: Pick<Checkoutable<never>, 'totalPrice'>;
+    }) {
+        // total price without rounding
+        const balanceItemsPrice = price - roundingAmount;
+
+        // also accept rounding that might have happend in the frontend and that was correct
+        if (checkout.totalPrice !== null && checkout.totalPrice !== balanceItemsPrice && checkout.totalPrice !== price) {
             throw new SimpleError({
                 code: 'changed_price',
-                message: $t(`%vk`, { total: Formatter.price(totalPrice) }),
+                message: $t(`%vk`, { total: Formatter.price(price) }),
             });
         }
+    }
 
-        const payment = new Payment();
-
-        // Who will receive this money?
-        payment.organizationId = organization.id;
-
-        // Who paid
-        payment.payingUserId = user.id;
-        payment.payingOrganizationId = payingOrganization?.id ?? null;
-
+    static async validateCustomer({ user, checkout, payingOrganization }: {
+        user: User | null;
+        checkout: Pick<Checkoutable<never>, 'customer'>;
+        payingOrganization?: Organization | null;
+    }) {
         // Fill in customer default value
-        payment.customer = PaymentCustomer.create({
-            firstName: user.firstName,
-            lastName: user.lastName,
-            email: user.email,
+        const customer = PaymentCustomer.create({
+            firstName: user?.firstName,
+            lastName: user?.lastName,
+            email: user?.email,
+            phone: checkout.customer?.phone,
         });
 
         // Use structured transfer description prefix
         let prefix = '';
 
         if (payingOrganization) {
-            if (totalPrice !== 0 || hasNegative || checkout.customer) {
-                if (!checkout.customer) {
-                    throw new SimpleError({
-                        code: 'missing_fields',
-                        message: 'customer is required when paying as an organization',
-                        human: $t(`%vz`),
-                    });
-                }
+            if (!checkout.customer) {
+                throw new SimpleError({
+                    code: 'missing_fields',
+                    message: 'customer is required when paying as an organization',
+                    human: $t(`%vz`),
+                });
+            }
 
-                if (!checkout.customer.company) {
-                    throw new SimpleError({
-                        code: 'missing_fields',
-                        message: 'customer.company is required when paying as an organization',
-                        human: $t(`%w0`),
-                    });
-                }
+            if (!checkout.customer.company) {
+                throw new SimpleError({
+                    code: 'missing_fields',
+                    message: 'customer.company is required when paying as an organization',
+                    human: $t(`%w0`),
+                });
+            }
 
-                // Search company id
-                // this avoids needing to check the VAT number every time
-                const id = checkout.customer.company.id;
-                const foundCompany = payingOrganization.meta.companies.find(c => c.id === id);
+            // Search company id
+            // this avoids needing to check the VAT number every time
+            const id = checkout.customer.company.id;
+            let foundCompany = payingOrganization.meta.companies.find(c => c.id === id);
 
-                if (!foundCompany) {
+            if (!foundCompany) {
+                if (payingOrganization.meta.companies.length > 0) {
                     throw new SimpleError({
                         code: 'invalid_data',
-                        message: $t(`%w1`),
+                        message: 'Cannot set company data. Please save the company data to the paying organization meta data before using it.',
+                        human: $t(`%w1`),
                     });
                 }
 
-                payment.customer.company = foundCompany;
+                // In case of no organizations, we ignore the id of the default, as this changes every time
+                // we'll only compare the contents
+                foundCompany = payingOrganization.defaultCompanies[0];
+            }
 
-                const orgNumber = parseInt(payingOrganization.uri);
+            if (!checkout.customer.company.equals(foundCompany)) {
+                throw new SimpleError({
+                    code: 'invalid_data',
+                    message: 'Cannot change company data. Please save the company data to the paying organization meta data before using it.',
+                    human: $t(`%w1`),
+                });
+            }
 
-                if (orgNumber !== 0 && !isNaN(orgNumber)) {
-                    prefix = orgNumber + '';
-                }
+            customer.company = foundCompany;
+
+            const orgNumber = parseInt(payingOrganization.uri);
+
+            if (orgNumber !== 0 && !isNaN(orgNumber)) {
+                prefix = orgNumber + '';
             }
-            else {
-                // Zero amount payment (without refunds) without specifying a company will just use the default company to link to the payment
-                // It doesn't really matter since the price is zero and we won't invoice it.
-                const company = payingOrganization.meta.companies[0];
-                if (company) {
-                    payment.customer.company = company;
-                }
+        } else {
+            if (checkout.customer && checkout.customer.company) {
+                customer.company = checkout.customer.company.clone();
+                await ViesHelper.checkCompany(checkout.customer.company, customer.company);
             }
         }
 
-        // Validate VAT rates for this customer
-        await this.validateVATRates({ customer: payment.customer, organization, balanceItems });
+        if (customer.company?.VATNumber !== checkout.customer?.company?.VATNumber) {
+            // Security check: because previous validation and generation might have used the VATNumber from the checkout
+            throw new SimpleError({
+                code: 'changed_VAT_number',
+                message: 'Unexpected VAT number change',
+            });
+        }
 
-        payment.status = PaymentStatus.Created;
-        payment.paidAt = null;
-        payment.price = totalPrice;
-        PaymentService.round(payment);
-        totalPrice = payment.price;
+        return { customer, prefix };
+    }
 
-        if (totalPrice === 0) {
-            payment.status = PaymentStatus.Succeeded;
-            payment.paidAt = new Date();
+    static async createProForma({ balanceItems, organization, user, members, checkout, payingOrganization }: {
+        balanceItems: Map<BalanceItem, number>;
+        organization: Organization;
+        user: User;
+        members?: Member[];
+        checkout: Pick<Checkoutable<never>, 'totalPrice' | 'customer' | 'cancelUrl' | 'redirectUrl'>;
+        payingOrganization?: Organization | null;
+    }) {
+        // Calculate total price to pay
+        const { price, roundingAmount } = PaymentService.calculateTotalPrice({ balanceItems, organization, members });
+        PaymentService.validateTotalPrice({ price, roundingAmount, checkout });
+
+        const { customer } = await PaymentService.validateCustomer({ user, checkout, payingOrganization });
+        const { seller } = PaymentService.validateVATRates({ customer, sellingOrganization: organization, balanceItems });
+
+        // Create invoice instead from fictive PaymentGeneral
+        const fakePaymentGeneral = PaymentGeneral.create({
+            id: 'pro-forma',
+            price,
+            customer,
+            method: PaymentMethod.Unknown,
+            balanceItemPayments: [...balanceItems.entries()].map(([balanceItem, price]) => {
+                return BalanceItemPaymentDetailed.create({
+                    id: 'pro-forma-' + balanceItem.id,
+                    balanceItem: balanceItem.getStructure(),
+                    price,
+                });
+            }),
+        });
+
+        let invoice: Invoice | null = null;
+
+        try {
+            invoice = Invoice.create({
+                seller,
+                customer,
+                payments: [fakePaymentGeneral],
+            });
+            invoice.buildFromPayments();
+        } catch (e) {
+            if ((isSimpleError(e) || isSimpleErrors(e)) && e.hasCode('balance_item_without_vat_percentage')) {
+                // ok
+                // Missing VAT that prevents invoice from being created
+            } else {
+                throw e;
+            }
+        }
+
+        return {
+            invoice,
+            payment: fakePaymentGeneral,
+        };
+    }
+
+    static async registerChargeback(payment: Payment, amount: number, date: Date) {
+        if (amount !== payment.price) {
+            // Creates issues to know what balance item was paid and what was not.
+            throw new Error('Cannot register chargeback with different amount than the payment for payment ' + payment.id);
+        }
+        const balanceItemPayments = await BalanceItemPayment.select().where('paymentId', payment.id).fetch();
+        const items = await BalanceItem.getByIDs(...Formatter.uniqueArray(balanceItemPayments.map(b => b.balanceItemId)));
+
+        // Done validation
+        const chargeback = new Payment();
+
+        // Who will receive this money?
+        chargeback.organizationId = payment.organizationId!;
+
+        // Who paid
+        chargeback.payingUserId = payment.payingUserId;
+        chargeback.payingOrganizationId = payment.payingOrganizationId;
+        chargeback.customer = payment.customer;
+
+        chargeback.status = PaymentStatus.Created;
+        chargeback.price = -payment.price;
+        chargeback.roundingAmount = -payment.roundingAmount;
+        chargeback.method = payment.method;
+        chargeback.type = PaymentType.Chargeback;
+        chargeback.mandateId = payment.mandateId; ;
+        chargeback.adminUserId = payment.adminUserId;
+
+        chargeback.provider = payment.provider;
+        chargeback.stripeAccountId = payment.stripeAccountId;
+        chargeback.reversingPaymentId = payment.id;
+        await chargeback.save();
+
+        for (const original of balanceItemPayments) {
+            // Create one balance item payment to pay it in one payment
+            const balanceItemPayment = new BalanceItemPayment();
+            balanceItemPayment.balanceItemId = original.balanceItemId;
+            balanceItemPayment.paymentId = chargeback.id;
+            balanceItemPayment.organizationId = chargeback.organizationId;
+            balanceItemPayment.price = -original.price;
+            await balanceItemPayment.save();
+        }
+
+        // Update cached balance items pending amount (only created balance items, because those are involved in the payment)
+        await BalanceItemService.updatePaidAndPending(items);
+
+        const organization = await Organization.getByID(chargeback.organizationId, true);
+
+        try {
+            await this.handlePaymentStatusUpdate(chargeback, organization, PaymentStatus.Succeeded, date);
+        } catch (e) {
+            console.error('Failed to mark chargeback as succeeded', e);
+            await chargeback.delete();
+            throw e;
         }
+        return chargeback;
+    }
 
-        // Validate payment method after customer is defined
-        const paymentConfiguration = organization.meta.registrationPaymentConfiguration;
-        const privatePaymentConfiguration = organization.privateMeta.registrationPaymentConfiguration;
+    static async createPayment({ balanceItems, organization, user, members, checkout, payingOrganization, serviceFeeType, createMandate, useMandate, paymentConfiguration, privatePaymentConfiguration, adminUserId }: {
+        balanceItems: Map<BalanceItem, number>;
+        organization: Organization;
+        user: User | null;
+        members?: Member[];
+        checkout: Pick<Checkoutable<never>, 'paymentMethod' | 'totalPrice' | 'customer' | 'cancelUrl' | 'redirectUrl'>;
+        payingOrganization?: Organization | null;
+        serviceFeeType: 'webshop' | 'members' | 'tickets' | 'system';
+        createMandate: CreateMandateSettings | null;
+        useMandate: PaymentMandate | null;
+        paymentConfiguration: PaymentConfiguration;
+        privatePaymentConfiguration: PrivatePaymentConfiguration;
+        adminUserId?: string | null;
+    }) {
+        if (balanceItems.size === 0) {
+            return null;
+        }
 
-        payment.method = checkout.paymentMethod ?? PaymentMethod.Unknown;
-        await this.validatePaymentMethod({ payment, balanceItems, paymentConfiguration });
+        // Calculate total price to pay
+        const { price, roundingAmount, hasNegative, names } = this.calculateTotalPrice({ balanceItems, organization, members });
+        PaymentService.validateTotalPrice({ price, roundingAmount, checkout });
+
+        const { customer, prefix } = await this.validateCustomer({ user, checkout, payingOrganization });
+        this.validateVATRates({ customer, sellingOrganization: organization, balanceItems });
+
+        const { method, type, mandate } = await this.validatePaymentMethod({
+            method: checkout.paymentMethod ?? PaymentMethod.Unknown,
+            mandate: useMandate,
+            createMandate: !!createMandate,
+            customer,
+            price,
+            hasNegative,
+            balanceItems,
+            paymentConfiguration,
+            user,
+            payingOrganization: payingOrganization ?? null,
+            sellingOrganization: organization,
+        });
 
-        // Validate URL's for online payments before saving the payment
-        if ((payment.method !== PaymentMethod.Transfer && payment.method !== PaymentMethod.PointOfSale && payment.method !== PaymentMethod.Unknown) && (!checkout.redirectUrl || !checkout.cancelUrl)) {
+        // Check URL's set fro online payments
+        if ((method !== PaymentMethod.Transfer && method !== PaymentMethod.PointOfSale && method !== PaymentMethod.Unknown) && (!checkout.redirectUrl || !checkout.cancelUrl) && !mandate) {
             throw new SimpleError({
                 code: 'missing_fields',
                 message: 'redirectUrl or cancelUrl is missing and is required for non-zero online payments',
@@ -551,6 +835,50 @@ export class PaymentService {
             });
         }
 
+        // Determine the payment provider (throws if invalid)
+        const { provider, stripeAccount } = await organization.getPaymentProviderFor(method, mandate, privatePaymentConfiguration);
+
+        if (createMandate && !mandate) {
+            if (provider !== PaymentProvider.Mollie) {
+                throw new SimpleError({
+                    code: 'cannot_create_mandate_for_provider',
+                    message: 'Saving a payment method is not yet supported for this payment method',
+                    human: $t('%1U0'),
+                });
+            }
+        }
+
+        // Done validation
+        const payment = new Payment();
+
+        // Who will receive this money?
+        payment.organizationId = organization.id;
+
+        // Who paid
+        payment.payingUserId = !payingOrganization ? (user?.id ?? null) : null;
+        payment.payingOrganizationId = payingOrganization?.id ?? null;
+        payment.customer = customer;
+
+        payment.status = PaymentStatus.Created;
+        payment.paidAt = null;
+        payment.price = price;
+        payment.roundingAmount = roundingAmount;
+        payment.method = method;
+        payment.type = type;
+        payment.createMandate = createMandate;
+        payment.mandateId = mandate?.id ?? null;
+        payment.adminUserId = adminUserId ?? null;
+
+        if (price === 0) {
+            payment.status = PaymentStatus.Succeeded;
+            payment.paidAt = new Date();
+        }
+
+        payment.provider = provider;
+        payment.stripeAccountId = stripeAccount?.id ?? null;
+        await ServiceFeeHelper.setServiceFee(payment, organization, serviceFeeType, [...balanceItems.entries()].map(([_, p]) => p));
+        await ServiceFeeHelper.setTransferFee({ payment, organization, stripeAccount });
+
         // Add transfer description
         if (payment.method === PaymentMethod.Transfer) {
             // remark: we cannot add the lastnames, these will get added in the frontend when it is decrypted
@@ -571,27 +899,19 @@ export class PaymentService {
                 {
                     name: groupedNames,
                     naam: groupedNames,
-                    email: user.email,
+                    email: customer.email ?? user?.email ?? '',
                     prefix,
                 },
             );
         }
 
-        // Determine the payment provider
-        // Throws if invalid
-        const { provider, stripeAccount } = await organization.getPaymentProviderFor(payment.method, privatePaymentConfiguration);
-        payment.provider = provider;
-        payment.stripeAccountId = stripeAccount?.id ?? null;
-        ServiceFeeHelper.setServiceFee(payment, organization, serviceFeeType, [...balanceItems.entries()].map(([_, p]) => p));
-
         await payment.save();
+
+        // Create online payment and balance item payments
         let paymentUrl: string | null = null;
         let paymentQRCode: string | null = null;
         const description = organization.name + ' ' + payment.id;
 
-        // Create balance item payments
-        const balanceItemPayments: (BalanceItemPayment & { balanceItem: BalanceItem })[] = [];
-
         try {
             for (const [balanceItem, price] of balanceItems) {
                 // Create one balance item payment to pay it in one payment
@@ -600,35 +920,35 @@ export class PaymentService {
                 balanceItemPayment.paymentId = payment.id;
                 balanceItemPayment.organizationId = organization.id;
                 balanceItemPayment.price = price;
-                await balanceItemPayment.save();
 
-                balanceItemPayments.push(balanceItemPayment.setRelation(BalanceItemPayment.balanceItem, balanceItem));
+                await balanceItemPayment.save();
             }
 
+            // Update cached balance items pending amount (only created balance items, because those are involved in the payment)
+            await BalanceItemService.updatePaidAndPending([...balanceItems.keys()]);
+
             // Update balance items
             if (payment.method === PaymentMethod.Transfer) {
                 // Send a small reminder email
                 try {
-                    await this.sendTransferEmail(user, organization, payment);
-                }
-                catch (e) {
+                    await this.sendTransferEmail(customer, user?.id ?? null, organization, payment);
+                } catch (e) {
                     console.error('Failed to send transfer email');
                     console.error(e);
                 }
-            }
-            else if (payment.method !== PaymentMethod.PointOfSale && payment.method !== PaymentMethod.Unknown) {
-                if (!checkout.redirectUrl || !checkout.cancelUrl) {
+            } else if (payment.method !== PaymentMethod.PointOfSale && payment.method !== PaymentMethod.Unknown) {
+                if ((!checkout.redirectUrl || !checkout.cancelUrl) && !mandate) {
                     throw new Error('Should have been caught earlier');
                 }
 
-                const _redirectUrl = new URL(checkout.redirectUrl);
+                const _redirectUrl = new URL(checkout.redirectUrl ?? ('https://' + STAMHOOFD.domains.dashboard));
                 _redirectUrl.searchParams.set('paymentId', payment.id);
-                _redirectUrl.searchParams.set('organizationId', organization.id); // makes sure the client uses the token associated with this organization when fetching payment polling status
+                _redirectUrl.searchParams.set('organizationId', payment.payingOrganizationId ?? organization.id); // makes sure the client uses the token associated with this organization when fetching payment polling status
 
-                const _cancelUrl = new URL(checkout.cancelUrl);
+                const _cancelUrl = new URL(checkout.cancelUrl ?? ('https://' + STAMHOOFD.domains.dashboard));
                 _cancelUrl.searchParams.set('paymentId', payment.id);
                 _cancelUrl.searchParams.set('cancel', 'true');
-                _cancelUrl.searchParams.set('organizationId', organization.id); // makes sure the client uses the token associated with this organization when fetching payment polling status
+                _cancelUrl.searchParams.set('organizationId', payment.payingOrganizationId ?? organization.id); // makes sure the client uses the token associated with this organization when fetching payment polling status
 
                 const redirectUrl = _redirectUrl.href;
                 const cancelUrl = _cancelUrl.href;
@@ -636,6 +956,17 @@ export class PaymentService {
                 const webhookUrl = 'https://' + organization.getApiHost() + '/v' + Version + '/payments/' + encodeURIComponent(payment.id) + '?exchange=true';
 
                 if (payment.provider === PaymentProvider.Stripe) {
+                    if (createMandate || mandate) {
+                        // Already checked, but for security
+                        throw new Error('Unsupported');
+                    }
+                    if (!customer.email) {
+                        throw new SimpleError({
+                            code: 'missing_email',
+                            message: 'Email address is required for online payments via Stripe',
+                            human: $t('%1SJ'),
+                        });
+                    }
                     const stripeResult = await StripeHelper.createPayment({
                         payment,
                         stripeAccount,
@@ -644,65 +975,48 @@ export class PaymentService {
                         statementDescriptor: organization.name,
                         metadata: {
                             organization: organization.id,
-                            user: user.id,
+                            user: user?.id,
                             payment: payment.id,
                         },
                         i18n: Context.i18n,
-                        lineItems: balanceItemPayments,
                         organization,
                         customer: {
-                            name: user.name ?? names[0]?.name ?? $t(`%Gr`),
-                            email: user.email,
+                            name: customer.name ?? names[0]?.name ?? $t(`%Gr`),
+                            email: customer.email,
                         },
                     });
                     paymentUrl = stripeResult.paymentUrl;
-                }
-                else if (payment.provider === PaymentProvider.Mollie) {
-                    // Mollie payment
-                    const token = await MollieToken.getTokenFor(organization.id);
-                    if (!token) {
-                        throw new SimpleError({
-                            code: '',
-                            message: $t(`%w3`, { method: PaymentMethodHelper.getName(payment.method) }),
-                        });
-                    }
-                    const profileId = organization.privateMeta.mollieProfile?.id ?? await token.getProfileId(organization.getHost());
-                    if (!profileId) {
-                        throw new SimpleError({
-                            code: '',
-                            message: $t(`%w4`, { method: PaymentMethodHelper.getName(payment.method) }),
-                        });
-                    }
-                    const mollieClient = createMollieClient({ accessToken: await token.getAccessToken() });
-                    const locale = Context.i18n.locale.replace('-', '_');
-                    const molliePayment = await mollieClient.payments.create({
-                        amount: {
-                            currency: 'EUR',
-                            value: (totalPrice / 100).toFixed(2),
-                        },
-                        method: payment.method == PaymentMethod.Bancontact ? molliePaymentMethod.bancontact : (payment.method == PaymentMethod.iDEAL ? molliePaymentMethod.ideal : molliePaymentMethod.creditcard),
-                        testmode: organization.privateMeta.useTestPayments ?? STAMHOOFD.environment !== 'production',
-                        profileId,
-                        description,
+                } else if (payment.provider === PaymentProvider.Mollie) {
+                    const mollieResult = await MollieService.createPayment({
+                        payment,
                         redirectUrl,
+                        cancelUrl,
                         webhookUrl,
+                        description,
                         metadata: {
-                            paymentId: payment.id,
+                            organization: organization.id,
+                            user: user?.id,
+                            payment: payment.id,
                         },
-                        locale: ['en_US', 'en_GB', 'nl_NL', 'nl_BE', 'fr_FR', 'fr_BE', 'de_DE', 'de_AT', 'de_CH', 'es_ES', 'ca_ES', 'pt_PT', 'it_IT', 'nb_NO', 'sv_SE', 'fi_FI', 'da_DK', 'is_IS', 'hu_HU', 'pl_PL', 'lv_LV', 'lt_LT'].includes(locale) ? (locale as any) : null,
+                        sellingOrganization: organization,
+                        payingOrganization: payingOrganization ?? null,
+                        user,
+                        customer,
+                        mandate,
                     });
-                    paymentUrl = molliePayment.getCheckoutUrl();
-
-                    // Save payment
-                    const dbPayment = new MolliePayment();
-                    dbPayment.paymentId = payment.id;
-                    dbPayment.mollieId = molliePayment.id;
-                    await dbPayment.save();
-                }
-                else if (payment.provider === PaymentProvider.Payconiq) {
+                    paymentUrl = mollieResult.paymentUrl;
+                } else if (payment.provider === PaymentProvider.Payconiq) {
+                    if (createMandate || mandate) {
+                        // Already checked, but for security
+                        throw new Error('Unsupported');
+                    }
                     ({ paymentUrl, paymentQRCode } = await PayconiqPayment.createPayment(payment, organization, description, redirectUrl, webhookUrl));
-                }
-                else if (payment.provider === PaymentProvider.Buckaroo) {
+                } else if (payment.provider === PaymentProvider.Buckaroo) {
+                    if (createMandate || mandate) {
+                        // Already checked, but for security
+                        throw new Error('Unsupported');
+                    }
+
                     // Increase request timeout because buckaroo is super slow (in development)
                     Context.request.request?.setTimeout(60 * 1000);
                     const buckaroo = new BuckarooHelper(organization.privateMeta?.buckarooSettings?.key ?? '', organization.privateMeta?.buckarooSettings?.secret ?? '', organization.privateMeta.useTestPayments ?? STAMHOOFD.environment !== 'production');
@@ -719,14 +1033,19 @@ export class PaymentService {
                     }
                 }
             }
-        }
-        catch (e) {
+        } catch (e) {
             await PaymentService.handlePaymentStatusUpdate(payment, organization, PaymentStatus.Failed);
             throw e;
         }
 
-        // Mark valid if needed
-        if (payment.method === PaymentMethod.Transfer || payment.method === PaymentMethod.PointOfSale || payment.method === PaymentMethod.Unknown) {
+        // TypeScript thinks status cannot change to Failed, but it can.
+        if (payment.status === PaymentStatus.Succeeded || (payment.status as PaymentStatus) === PaymentStatus.Failed) {
+            // force update
+            const updateTo = payment.status;
+            payment.status = PaymentStatus.Created;
+            await PaymentService.handlePaymentStatusUpdate(payment, organization, updateTo);
+        } else if (payment.method === PaymentMethod.Transfer || payment.method === PaymentMethod.PointOfSale || payment.method === PaymentMethod.Unknown || (payment.method === PaymentMethod.DirectDebit && mandate)) {
+            // Mark valid (not same as paid) if needed
             let hasBundleDiscount = false;
             for (const [balanceItem] of balanceItems) {
                 // Mark valid
@@ -745,7 +1064,6 @@ export class PaymentService {
 
         return {
             payment,
-            balanceItemPayments,
             provider,
             stripeAccount,
             paymentUrl,
@@ -753,7 +1071,12 @@ export class PaymentService {
         };
     }
 
-    static async sendTransferEmail(user: User, organization: Organization, payment: Payment) {
+    static async sendTransferEmail(customer: PaymentCustomer, userId: string | null, organization: Organization, payment: Payment) {
+        const email = customer.dynamicEmail;
+        if (!email) {
+            console.warn('Skipped sending transfer email because of missing email address', payment.id);
+            return;
+        }
         const paymentGeneral = await payment.getGeneralStructure();
         const groupIds = paymentGeneral.groupIds;
 
@@ -761,10 +1084,10 @@ export class PaymentService {
 
         const recipients = [
             Recipient.create({
-                firstName: user.firstName,
-                lastName: user.lastName,
-                email: user.email,
-                userId: user.id,
+                firstName: customer.firstName,
+                lastName: customer.lastName,
+                email: email,
+                userId,
                 replacements,
             }),
         ];
@@ -786,88 +1109,242 @@ export class PaymentService {
         });
     }
 
-    static async validatePaymentMethod({ payment, balanceItems, paymentConfiguration }: { payment: Payment; balanceItems: Map<BalanceItem, number>; paymentConfiguration: PaymentConfiguration }) {
-        if (payment.price === 0) {
+    static async validateMandate({
+        method,
+        paymentConfiguration,
+        mandate,
+        payingOrganization,
+        sellingOrganization,
+        user,
+    }: {
+        method: PaymentMethod;
+        paymentConfiguration: PaymentConfiguration;
+        mandate: PaymentMandate;
+        payingOrganization: Organization | null;
+        sellingOrganization: Organization;
+        user: User | null;
+    }) {
+        if (!paymentConfiguration.enableMandates) {
+            throw new SimpleError({
+                code: 'mandates_disabled',
+                message: 'Cannot pay with mandate',
+                human: $t('%1SK'),
+            });
+        }
+
+        // Validate mandate + update payment method based on the mandate
+        if (method !== PaymentMethod.Unknown) {
+            throw new SimpleError({
+                code: 'invalid_data',
+                message: 'Cannot combine setting mandate with method',
+            });
+        }
+
+        const allMandates = await PaymentMandateService.getMandates({
+            payingOrganization,
+            sellingOrganization,
+            user,
+        });
+
+        const existingMandate = allMandates.find(m => m.id === mandate.id && m.provider === mandate.provider);
+        if (!existingMandate) {
+            throw new SimpleError({
+                code: 'not_found',
+                message: 'Mandate not found',
+                human: $t('%1TQ'),
+                field: 'mandateId',
+            });
+        }
+
+        if (existingMandate.status !== PaymentMandateStatus.Valid) {
+            throw new SimpleError({
+                code: 'mandate_not_valid',
+                message: 'Mandate not valid',
+                human: $t('%1QA'),
+                field: 'mandateId',
+            });
+        }
+        return existingMandate;
+    }
+
+    static async validatePaymentMethod({
+        method,
+        customer,
+        price,
+        hasNegative,
+        balanceItems,
+        paymentConfiguration,
+        mandate,
+        payingOrganization,
+        sellingOrganization,
+        user,
+        createMandate,
+    }: {
+        method: PaymentMethod;
+        customer: PaymentCustomer;
+        price: number;
+        hasNegative: boolean;
+        balanceItems: Map<BalanceItem, number>;
+        paymentConfiguration: PaymentConfiguration;
+        mandate: PaymentMandate | null;
+        payingOrganization: Organization | null;
+        sellingOrganization: Organization;
+        user: User | null;
+        createMandate: boolean;
+    }) {
+        if (price === 0) {
             if (balanceItems.size === 0) {
-                return;
+                throw new Error('Empty payment');
+            }
+
+            // We still need to validate the mandate, because
+            // we still allow setting a new default payment method
+            // for zero payments
+            // - e.g. activating a new package with an existing mandate
+            const existingMandate = mandate
+                ? await this.validateMandate({
+                        method,
+                        mandate,
+                        paymentConfiguration,
+                        payingOrganization,
+                        sellingOrganization,
+                        user,
+                    })
+                : null;
+
+            if (createMandate && !existingMandate) {
+                throw new SimpleError({
+                    code: 'cannot_create_mandate_without_payment',
+                    message: 'Cannot create saved payment method without payment of a small amount',
+                    human: $t(`%1Ss`),
+                });
             }
+
             // Create an egalizing payment
-            payment.method = PaymentMethod.Unknown;
+            if (hasNegative) {
+                return {
+                    method: PaymentMethod.Unknown,
+                    type: PaymentType.Reallocation,
+                    mandate: existingMandate,
+                };
+            }
+
+            return {
+                // Free purchase
+                method: PaymentMethod.Unknown,
+                type: PaymentType.Payment,
+                mandate: existingMandate,
+            };
+        }
+
+        if (mandate) {
+            const existingMandate = await this.validateMandate({
+                method,
+                mandate,
+                paymentConfiguration,
+                payingOrganization,
+                sellingOrganization,
+                user,
+            });
 
-            if ([...balanceItems.values()].find(b => b < 0)) {
-                payment.type = PaymentType.Reallocation;
+            switch (existingMandate.type) {
+                case PaymentMandateType.CreditCard:
+                    return {
+                        mandate: existingMandate,
+                        method: PaymentMethod.CreditCard,
+                        type: PaymentType.Payment,
+                    };
+                case PaymentMandateType.DirectDebit:
+                    return {
+                        mandate: existingMandate,
+                        method: PaymentMethod.DirectDebit,
+                        type: PaymentType.Payment,
+                    };
             }
+
+            throw new Error('Unsupported mandate type');
         }
-        else if (payment.method === PaymentMethod.Unknown) {
+
+        if (createMandate) {
+            if (!paymentConfiguration.enableMandates) {
+                throw new SimpleError({
+                    code: 'mandates_disabled',
+                    message: 'Cannot pay with mandate',
+                    human: $t('%1R1'),
+                });
+            }
+        }
+
+        if (method === PaymentMethod.Unknown) {
             throw new SimpleError({
                 code: 'invalid_data',
                 message: $t(`%vy`),
             });
         }
-        else {
-            // Validate payment method
-            const allowedPaymentMethods = paymentConfiguration.getAvailablePaymentMethods({
-                amount: payment.price,
-                customer: payment.customer,
-            });
 
-            if (!allowedPaymentMethods.includes(payment.method)) {
-                throw new SimpleError({
-                    code: 'invalid_payment_method',
-                    message: $t(`%vp`),
-                });
-            }
+        // Validate payment method
+        const allowedPaymentMethods = paymentConfiguration.getAvailablePaymentMethods({
+            amount: price,
+            customer: customer,
+            forMandate: createMandate,
+        });
+
+        if (!allowedPaymentMethods.includes(method)) {
+            throw new SimpleError({
+                code: 'invalid_payment_method',
+                message: $t(`%vp`),
+            });
         }
+
+        return {
+            method,
+            type: PaymentType.Payment,
+            mandate: null,
+        };
     }
 
-    static async validateVATRates({ customer, organization, balanceItems }: { customer: PaymentCustomer; organization: Organization; balanceItems: Map<BalanceItem, number> }) {
+    static validateVATRates({ customer, sellingOrganization, balanceItems }: { customer: PaymentCustomer; sellingOrganization: Organization; balanceItems: Map<BalanceItem, number> }) {
         // Validate VAT rates for this customer
-        const seller = organization.meta.companies[0];
-        if (seller && seller.VATNumber && seller.address && customer.company) {
-            // B2B validation
-            if (!customer.company.address) {
-                throw new SimpleError({
-                    code: 'missing_field',
-                    message: 'Company address missing',
-                    human: $t('%1LH'),
-                    field: 'customer.company.address',
-                });
-            }
+        const seller = VATService.getDefaultCompanyForOrganization(sellingOrganization);
+        const excempt = VATService.isVATExcempt({
+            company: customer.company,
+            sellingOrganization,
+        });
 
-            // Reverse charged vat applicable?
-            if (customer.company.address.country !== seller.address.country) {
-                // Check VAT Exempt is set on each an every balance item with a non-zero price
-                for (const [item] of balanceItems) {
-                    if (item.VATExcempt !== VATExcemptReason.IntraCommunity) {
-                        throw new SimpleError({
-                            code: 'VAT_error',
-                            message: 'Intra community VAT reverse charge not supported for this purchase',
-                            human: $t('%1LI'),
-                        });
-                    }
+        // Reverse charged vat applicable?
+        if (excempt) {
+            // Check VAT Exempt is set on each an every balance item with a non-zero price
+            for (const [item] of balanceItems) {
+                if (item.VATExcempt !== VATExcemptReason.IntraCommunityServices && item.VATExcempt !== VATExcemptReason.IntraCommunityGoods) {
+                    throw new SimpleError({
+                        code: 'VAT_error',
+                        message: 'Intra community VAT reverse charge not supported for this purchase',
+                        human: $t('%1LI'),
+                    });
+                }
 
-                    // We also need to know the VAT rate exactly to be sure the VAT is removed from the purchase
-                    // If VAT is not included, we don't need to know the VAT percentage until the payment is invoiced
-                    if (item.VATPercentage === null && item.VATIncluded) {
-                        throw new SimpleError({
-                            code: 'VAT_error',
-                            message: 'Intra community VAT reverse charge is not supported for this purchase because of missing VAT rates',
-                            human: $t('%1LJ'),
-                        });
-                    }
+                // We also need to know the VAT rate exactly to be sure the VAT is removed from the purchase
+                // If VAT is not included, we don't need to know the VAT percentage until the payment is invoiced
+                if (item.VATPercentage === null && item.VATIncluded) {
+                    throw new SimpleError({
+                        code: 'VAT_error',
+                        message: 'Intra community VAT reverse charge is not supported for this purchase because of missing VAT rates',
+                        human: $t('%1LJ'),
+                    });
                 }
             }
-            else {
-                // Fine to just not have setup VAT rates yet if the price is guaranteed to include VAT
-                for (const [item] of balanceItems) {
-                    if (item.VATExcempt === VATExcemptReason.IntraCommunity) {
-                        throw new SimpleError({
-                            code: 'VAT_error',
-                            message: 'Unexpected reverse charge applied',
-                            human: $t('%1LK'),
-                        });
-                    }
+        } else {
+            // Fine to just not have setup VAT rates yet if the price is guaranteed to include VAT
+            for (const [item] of balanceItems) {
+                if (item.VATExcempt === VATExcemptReason.IntraCommunityGoods || item.VATExcempt === VATExcemptReason.IntraCommunityServices) {
+                    throw new SimpleError({
+                        code: 'VAT_error',
+                        message: 'Unexpected reverse charge applied',
+                        human: $t('%1LK'),
+                    });
+                }
 
+                if (seller && seller.VATNumber) {
                     if (!item.VATIncluded && item.VATPercentage === null) {
                         throw new SimpleError({
                             code: 'VAT_error',
@@ -878,12 +1355,25 @@ export class PaymentService {
                 }
             }
         }
+
+        /* if (seller && seller.VATNumber && seller.address && customer.company) {
+            // B2B validation
+            if (!customer.company.address) {
+                throw new SimpleError({
+                    code: 'missing_field',
+                    message: 'Company address missing',
+                    human: $t('%1LH'),
+                    field: 'customer.company.address',
+                });
+            }
+
+        }
         else {
             // B2C / C2B / C2C
 
             // You cannot buy balance items with VAT if you didn't set up a VAT number.
             for (const [item] of balanceItems) {
-                if (item.VATExcempt === VATExcemptReason.IntraCommunity) {
+                if (item.VATExcempt === VATExcemptReason.IntraCommunityGoods || item.VATExcempt === VATExcemptReason.IntraCommunityServices) {
                     throw new SimpleError({
                         code: 'VAT_error',
                         message: 'Unexpected reverse charge applied',
@@ -901,6 +1391,8 @@ export class PaymentService {
                     }
                 }
             }
-        }
+        } */
+
+        return { seller };
     }
 };